Hello, friends. How have you been? I wish you all a great start to 2023. Anyway, have you by any chance heard that (ISC)2 provided free cybersecurity training and exam for 1 million people? If you haven’t then please check it out: One Million FREE (ISC)² Certified in Cybersecurity Courses and Exams. 

I recently had the opportunity to take the training and exam and after experiencing it first-hand, I encourage you to do so. I know you may or may not see yourself in that one of the most talked-about fields in IT. However, whether you want to have a career in cybersecurity or not, I suggest that you learn it (especially when it comes with no price tag) since protecting information is a significant part of our life in the digital era. Learning the fundamental of it wouldn’t hurt you and I believe that you’ll thank yourself later for doing that. Okay--enough for me promoting cybersecurity or I could spend hours talking about it--pardon me I can’t help it. Now let’s get to the point. Hihi. I divided the story into three parts: before, during, and after the exam.

Before the Exam

After I heard about the free online self-paced training and exam, I directly visited the website to get more information about it. After going through all the provided information, I decided to give it a go. I created an account and then completed the (ISC)2 candidate application form with certified in cybersecurity as my certification of interest. Shortly after that, I gained access to the training and exam registration. I picked the test center near UNSW as I am quite familiar with the location and for the date, I choose to have it after the new year since I wanted to have a full break during the year-end holiday.

When I almost finished the training, I was curious about what other people said regarding the exam. Was it difficult? Were the materials provided in the training enough? I was lucky that I tried to find the information or I would think that my simple preparation was enough. Unless you have quite intensive experience in the field, please go beyond the training materials. In my case, I read the Eleventh Hour CISSP®: Study Guide (Conrad et al, 2016--I found out that there is a newer edition of it but since I only had the third version, I used it). In total, the preparation took me 5 days during my university term break when I have no other agenda but studying (but of course, I didn’t study for 10 hours a day--I watched Chinese drama and did random things in between).

On the last day of preparation, I ensured that I understood everything I need to know (including bringing 2 personal IDs and how to get to the test center) then sleep early.

During the Exam

I arrived at the test center very early (I liked it this way for every exam I took) and then told the test administrator (TA) that I wanted to take an exam. He asked for my ID, had me submit my palm vein scan, and took my exam candidate's photo. He then guided me to the waiting room and said that I can take the exam whenever I am ready. After a quick review of the summary I wrote about the things I found challenging (such as the port numbers as during my time as an IT auditor, I didn't memorize them all), I entered the exam room and faced the 100 questions.

If you have read my previous exam experience posts, you would notice that I am a big fan of do-it-quickly-then-review-it. However, turned out that for this exam, this doesn’t apply. I was stubborn even after I saw there was no "back" button on the exam page to go to the previous question. I kept doing it quickly thinking that it might have a “review all” option after I finished all the questions. To my surprise, after I completed the 100^th questions, the only button left is “end exam”. Haha. I quietly had my panicky laugh because how can I be that stubborn to ignore the suspicion that I wouldn’t be able to review the answers. I finished the exam in 64 minutes out of the 120 minutes provided due to my obstinate attitude toward the sign. When you take the exam later, please learn from my mistake and use your time wisely.

I left the exam room hearing the TA ask me how was my exam experience. I told him that I was clueless that this exam didn’t let me go back to review my answers. He then told me usually exams have that feature, tried to console me. I thought I failed so I didn't have the courage to ask him about my results paper. While the exam was free, after all the effort I took during the supposed summer break when students usually don’t study at all, I found myself a bit disappointed.

“It’s okay. I learned my lesson that I shouldn’t treat everything solely based on my experience. Every case could be different.” I smiled at him eventually after regaining my balance.

“But you passed,” he handed me a piece of paper. It was the exam provisional results with the opening word 'congratulations'.

“Are you serious?” I couldn’t hide my shocked expression.

“Yes. Congratulations,” he threw me a reassuring smile as if he knew I wouldn’t believe the paper even when I read it by myself.

“Thank you so much. I really appreciate your help today,” I smiled at him back.

That confused face coincidentally reflected my actual expression upon receiving this paper :)

After the Exam

The day after the exam, I received an email stating that I officially passed the exam. The next step is to complete the online application, which the candidate must do within nine months of the exam date.  Within 24 hours after the application is completed, the candidate can perform the final step in the process which is paying the first Annual Maintenance Fee (AMF). Once the AMF payment is made, we will earn the certification.

You might ask, “so it is not actually free?”. It is free if all you want is knowledge provided in the training and the exam. It is still up to you whether you want to get the certification or not. In my case, as a little treat to myself, I don't mind spending $50 to get the certification. However, it is totally your choice to pay for it or not so don’t worry. Gaining knowledge and exam experience is valuable for us even without the certification.

The Tips

I wanted to close this post by sharing some tips based on my experience. First and foremost, understand why you need it. Only when you know the reason, do you have a strong determination to embrace the journey. Then, be sure to set aside enough time to study. Another important tip is to take advantage of all of the resources that are available to you. Don't be afraid to ask for help if you're struggling and ask someone when you are confused. Be sure to get plenty of rest and stay healthy in the days leading up to the exam. A clear mind and a healthy body will help you perform your best on exam day. Lastly, as you can't go back to the previous question, take your time to choose the answer before moving to the next question.

Okay. Before this post goes too long, I will end it here. I am happy to take your questions if you have any and if you need help, don’t hesitate to reach out. I wish you all the best.

--------

Indonesian Version: Pengalaman Mengikuti Ujian Certified in Cybersecurity (CC)

Ada kerinduan menulis dalam bahasa ibu, seperti kehendak menyimak sepasang bola hitam di wajahmu tatkala aku tenggelam dalam kerumunan bola biru dan abu-abu. Terdapat keinginan kembali menyusuri jalanan kota di mana kau berada--walau berdebu, walau kelabu. Aku tersenyum meski menghabiskan waktu mencuri pandang sedang jarak pandangmu ke arahku sesak oleh debu. Aku masih akan menatapmu seolah ikan yang kaujerat dengan bubu lalu kausimpan dalam kumbu. Apakah ini yang Sapardi sebut sebagai “Aku ingin mencintaimu dengan sederhana dengan kata yang tak sempat diucapkan kayu kepada api yang menjadikannya abu”?

Apa kabar, pria yang tersenyum bak sari tebu? Kalender menunjukkan hari Rabu di mana umumnya beban pekerjaan tengah sibuk-sibuknya menyerbu. Kuharap di hari seperti itu, hatimu masih sekokoh terumbu. Semoga di sana langitmu tak mengabu di tengah hentak lari di sekeliling nan menggebu. Kudoakan agar kegaduhan yang beriak dari klakson kendaraan di ibukota tidak mengusik sudut kalbu.

Apakah kau sudi mendengar kabarku, lelaki berpipi merah jambu? Hari-hariku menjemukan seperti masakan di kota ini yang miskin bumbu. Aku kemudian teringat bagaimana pagi harimu kerap diwarnai semangkuk lontong sayur labu. Kadangkala aku iri bagaimana matamu berbinar menceritakan makanan berkuah seharga lima ribu.

Kau pasti luput menyadari bahwa jiwa ini, terpaut benua denganmu, bak air di atas lumbu. Seperti sumbu yang berusaha ditegakkan dalam lampu minyak tetapi ia tetaplah sumbu. Maka aku menulis dengan bahasa ibu agar kerinduan memiliki keberanian berpindah kubu. Barangkali kau tidak sengaja membacanya lalu mengerti perasaan yang kubawa lelap di balik kelambu.

Sedari mula aku tahu bahwa berperang dengan perasaan tentangmu ibarat menghadapi pasukan bersenjata lengkap dengan hanya bermodal sebilah bambu. Hanya saja aku tetap menulis dengan bahasa ibu agar kau menyadari makna tatapan yang tersembunyi di balik debu.

-----------------

image source: adriansart

(Belum lama ini, saya menjuri lomba cipta puisi Hakordia 2022 dan kala menyelami bait-bait indah, saya tersenyum sembari berujar, "bahasa Indonesia sungguh cantik". Maka saya pun rindu menulis dalam bahasa ibu, bahasa yang meski saya mencoba memasuki gelanggang bahasa mana pun, akan tetap menjadi bahasa paling cantik karena kekayaan kosakatanya. Raga saya dapat berada di benua mana pun, jiwa saya dapat mempelajari bahasa mana pun, tetapi bahasa ini akan selalu menjadi yang tercantik. Lalu, saya mempersonifikasikan bahasa ibu itu sebagai seseorang. Kerinduan akan sesuatu yang kita sangat familiar dengannya bukankah selalu terdengar dramatis?)

image source: intellectualpoint.com

Halo semuanya. Saya berharap teman-teman semua sehat dan bahagia selalu ya. Dengan rendah hati saya sampaikan bahwa saya baru saja mendapatkan CRISC (Certified in Risk and Information Systems Control). Saya berkomitmen untuk selalu menuliskan tips melewati setiap ujian sertifikasi yang saya ikuti sebagai ungkapan kesyukuran dan juga untuk membantu setiap kandidat ujian sertifikasi di luar sana. Jadi, inilah tips lulus ujian CRISC versi saya:

(P.S.: beberapa di antaranya mirip dengan tips untuk lulus ujian CISA dan tips ujian CGEIT yang diterbitkan sebelumnya karena saya yakin ketiganya memerlukan persiapan yang serupa)

1. Ujian sertifikasi memang selalu tampak luar biasa sulit, percaya dirilah

Saya mendaftarkan diri untuk ujian CRISC setahun yang lalu kemudian menunda-nunda ujiannya hingga tanggal terakhir yang diperbolehkan (1 tahun sejak pendaftaran disetujui). Saya terus menunda persiapan karena merasa ini akan menjadi proses yang luar biasa sulit (berbicara tentang menunda-nunda, saya adalah seorang ahli. hihi). Selain itu, saya tidak memiliki kepercayaan diri yang cukup untuk melaksanakan ujian segara. Bagaimana jika saya gagal? Saya tahu harga ujiannya tidak murah jadi saya meyakinkan diri untuk hanya mengambilnya ketika sudah sangat siap. Namun tebak apa hasilnya? Tiba-tiba saya tidak bisa menjadwalkan ulang tanggal ujian lagi karena ternyata telah menghabiskan hampir setahun menunda-nundanya. Hihi. Akhirnya, setelah penundaan yang panjang, saya hanya memiliki 4 hari persiapan! Saya panik tetapi tidak ada cara untuk memutar ulang waktu. Saya hanya bisa bergerak maju, siap atau tidak.

Jika saya dapat memberikan nasihat kepada diri saya kala itu, saya akan berkata: ujian sertifikasi selalu tampak luar biasa sulit. Percayalah pada diri sendiri dan sekarang mulailah belajar 😊

 2. Honorable mention: criscexamstudy.com

Tentu saja, persiapan 4 hari bukanlah praktik yang disarankan. Teman-teman harus belajar dari kesalahan pemalas satu ini yang hobi menunda segalanya sampai akhir. Dengan keterbatasan waktu, yang saya lakukan saat itu adalah mempelajari materi dari criscexamstudy.com (website ini sangat membantu). Silakan pelajari setiap materi (yang disajikan dengan rapi sebagai poin-poin kunci--menyenangkan bukan?) dan soal latihan yang mengikutinya. Saya juga mengidentifikasi gap pengetahuan saya dan menulis catatan yang berisi itu. Saya membaca catatan itu kembali kapan pun saya bisa. Saya mendapatkan pemahaman yang cukup komprehensif tentang poin-poin penting yang tercakup dalam ujian CRISC dalam 2 hari mempelajarinya melalui website ini.

3. Mengikuti pelatihan CRISC Review

Ketika saya menyebutkan 4 hari persiapan, yang saya maksud adalah belajar mandiri yang intensif sebelum ujian. Namun, persiapan sebenarnya tidak sesingkat itu. Sebelum mengikuti ujian CRISC, saya mengikuti pelatihan persiapan. Bagi teman-teman yang ingin memperkuat persiapannya dan memiliki kesempatan, harap pertimbangkan untuk mengikuti pelatihan CRISC review. Namun jangan khawatir jikapun teman-teman tidak bisa mengikuti pelatihan, kita masih bisa memiliki persiapan yang cukup.

 4. Peroleh Pengetahuan dan Pengalaman di Bidang Risiko dan Pengendalian TI

Memiliki pengetahuan dan pengalaman di bidang risiko dan pengendalian TI tentu sangat penting dalam menyelesaikan soal-soal ujian CRISC. Untuk mendapatkan pengetahuan yang dibutuhkan, saran saya banyaklah membaca referensi terkait risiko dan pengendalian TI, mendiskusikannya dengan orang lain, atau bergabung dengan komunitas (atau apa pun. Pilih cara favorit teman-teman untuk menyerap pengetahuan). Sementara itu, menjawab beberapa pertanyaan ujian CRISC mengharuskan kandidat untuk tidak hanya dibekali dengan pengetahuan tetapi juga pengalaman sehingga paparan di kehidupan nyata pasti akan bermanfaat. Pengalaman membentuk logika, perspektif, dan kebijaksanaan yang akan memudahkan kita menemukan jawabannya.

Selain itu, menurut saya, penting untuk meningkatkan eksposur terhadap istilah TI dan bahasa Inggris (terutama ketika TI bukan bidang kita dan bahasa Inggris bukan bahasa pertama kita).  Familiarity with IT terms and English is advantageous!

5. Pelajari CRISC Review Manual dan CGEIT Review Questions, Answers & Explanations Manual (QAE)

Review Manual dan QAE adalah dua referensi sakral untuk semua orang yang ingin meraih sertifikasi ISACA. Luangkan waktu untuk membaca kedua buku ini dari awal sampai akhir terutama QAE karena memperkenalkan kita pada jenis pertanyaan yang akan kita hadapi. Pahami penjelasan dari jawaban-jawaban yang disarankan buku tersebut untuk mendapatkan logika, perspektif, dan kearifan yang ditetapkan ISACA. Oh ya, pastikan mempelajari versi terbaru dari buku-buku ini ya. Saat ini, CRISC Review Manual terbaru adalah edisi ke-7 dan QAE Review edisi ke-6.

6. Berlatih Melalui Mock Exams

Mengikuti mock exams sangat penting agar kita terbiasa duduk dan berpikir tanpa gangguan selama berjam-jam. Kerjakan pertanyaan sampai teman-teman mendapatkan setidaknya 80% jawaban benar. Saya sendiri mencoba menyelesaikan setiap mock exam dalam 2 jam untuk melatih kemampuan berpikir cepat dan menyelesaikan ujian di bawah tekanan.

7. Perhatikan Kondisi Fisik dan Mental Kita

Menjaga kesehatan dan kebugaran untuk ujian sangat penting. Pastikan teman-teman tidur cukup agar keesokan paginya fit untuk mengerjakan 150 soal dalam 4 jam. Pastikan juga kita sarapan pagi, tiba di tempat ujian/membuka website ujian lebih awal, dan yang tak kalah pentingnya adalah mengelola kondisi emosi dan mental kita. Tenang. kita sudah cukup mempersiapkan diri dan siap menghadapi ujian ini.

8. Berdoa

Tips ini akan selalu saya ulangi di setiap post tips ujian karena memang sepenting itu. berdoalah agar kita diberi kemudahan dalam mengerjakan soal-soal. Berdoalah agar soal-soalnya berpihak dengan pengetahuan dan persiapan kita 😊

9.  Tips Lainnya

a. Baca silabus untuk memahami apa yang perlu dipahami dan porsinya masing-masing dibandingkan dengan keseluruhan materi ujian.

B. Menjadwalkan ujian dan menetapinya adalah salah satu cara terbaik untuk mulai belajar. Jangan meniru saya yang terus-menerus menjadwalkan ulang ujian sehingga tidak lekas mulai belajar.

C. Pengetahuan yang kita peroleh dari pengalaman adalah sesuatu yang harus disikapi dengan bijak: terkadang membantu, terkadang tidak dalam ujian ini. Terdapat kemungkinan pengetahuan yang kita peroleh tidak sesuai dengan standar/kerangka kerja yang ditetapkan oleh ISACA. Oleh karena itu, kita harus mengidentifikasi keselarasan pengetahuan kita dengan body of knowledge ISACA.

10. Tips Selama Ujian

a. Jika teman-teman mengikuti ujian di pusat ujian (test center), perhatikan suhu ruang ujian. Apabila terlalu dingin untuk didiami selama 4 jam, kenakan jaket. Selain itu, duduklah senyaman mungkin. Empat jam bukanlah waktu yang singkat. 😊

B. Kerjakan dengan tenang. Kita memiliki waktu yang relatif lama untuk melakukannya. Jika kita tenang, kita akan lebih teliti. Pada ujian di mana ada banyak pertanyaan dan jawaban yang rumit (dan akurasi menjadi kuncinya), mengelola ketenangan adalah suatu keharusan.

C. Hati-hati dengan jawaban "hampir benar". Secara umum, pertanyaan CGEIT memberi kita 2 alternatif jawaban yang keduanya tampak benar. Hehe. Pastikan memilih yang benar, bukan yang terlihat benar.

D. Fokus pada pertanyaan yang mudah terlebih dahulu. Kita bisa melewati pertanyaan yang sulit/panjang (jangan lupa untuk menandainya). Nantinya kita bisa kembali kepada soal-soal yang kita lewati.

e. Durasi ujian memungkinkan kita untuk meninjau ulang jawaban. Tinjau jawaban seolah-olah kita mengerjakannya lagi dari awal. Jangan bosan dulu meski stamina dan konsentrasi sudah menurun. Ini saran pribadi saya: kecuali teman-teman begitu yakin dengan hasilnya, gunakan 4 jam sepenuhnya.

F. Jika teman-teman mengambil pilihan proctored exam (seperti yang saya ambil kali ini), peserta ujian memiliki waktu istirahat dua kali (masing-masing 10 menit). Istirahat ini juga diberikan jika teman-teman mengikuti tes di test center. Baca panduan ujian secara teliti untuk mengetahui hal yang boleh dan tidak boleh, seperti tidak boleh membaca soal dengan bersuara. Selain itu, mulailah membuka website ujiannya selambatnya 30 menit sebelum waktu ujian agar memiliki waktu menyelesaikan kendala apabila menemuinya.

G. Jangan lupa untuk mengisi kuesioner post-test.

Itulah tips yang bisa saya bagikan kepada teman-teman yang ingin mengikuti ujian CRISC. Semoga sukses teman-teman semuanya. Jika teman-teman memiliki pertanyaan, jangan ragu untuk menghubungi saya ya. Dengan senang hati saya usahakan untuk membantu. Semangat!

------

English version:  My CRISC Exam Experience

image source: intellectualpoint.com

Hello, everyone. I hope you all are doing well and staying safe. I’m humbled to share that I just officially got my CRISC (Certified in Risk and Information Systems Control) designation. I’ve committed to always writing down the tips to pass every certification exam I take as my token of gratitude and also to help CRISC aspirants out there, here is my story on how I passed the exam:

(P.S.: some of them are similar to the tips to pass a CISA exam and tips to pass a CGEIT exam I posted previously as I believed they shared the similar kind of necessary preparations)

1.   It always seems overwhelming, have confidence in yourself

I registered myself for the exam a year ago to only took the exam on the last possible date (1 year since the registration got approved). I kept delaying the preparation by telling myself that it would be an overwhelming process (talking about procrastination, I am a virtuoso. LoL). Other than that, I didn’t have enough confidence to take it sooner. What if I failed? I know the exam price isn’t cheap so I convinced myself only to take it when I am highly ready. Guess what? Little did I know, I can’t reschedule my exam date anymore because turned out I have spent almost 365 days postponing it. Hihi. And eventually, after the long delay, I only have 4 days of preparation! I was left panicked but there was no turning back. I can only move forward, ready or not.

If I can give my younger self some advice, it would be: certification exams always seem overwhelming. Have confidence in yourself and now start studying 😊

 2.     Give it up for criscexamstudy.com

Of course, 4 days of preparation is not a recommended practice. You all should learn from this procrastinator’s mistake of putting everything until the very end. With the limited time, I learned the material from criscexamstudy.com (this website was significantly helpful). Everyone, please study each material (which is neatly presented as key points--don’t we love that?) and the subsequent practice questions. I also identified my knowledge gaps and wrote down a note containing them. I reread it again whenever I could. I get a fairly comprehensive understanding of the key points covered in the CRISC exam in 2 days of studying it. It is safe to say that this website deserved an honorable mention.  

3. Attend a CRISC review training

When I said 4 days of preparation, what I meant is the intense self-study before the exam. However, definitely, the actual preparation wasn’t that short. Before attempting the CRISC exam, I attended preparation training. For those who want to strengthen their preparation and have the opportunity, please consider attending a CRISC review training. But don’t worry even if you can't sit in on the training, you can still have sufficient preparation.

 4. Obtain (technical and managerial) knowledge and experience in the IT risk and control fields

Having technical and managerial knowledge of IT risk and control is certainly substantial in solving CRISC exam questions. Regarding acquiring the needed knowledge, my advice is to read lots of references related to IT risk and control, discuss them with others, or join a community (or anything. Pick your favorite way of absorbing knowledge). Meanwhile, answering some CRISC exam questions, requires the candidate to be equipped with not only knowledge but also experience so real-life exposure will surely be beneficial. Experience shapes our logic, perspective, and wisdom which will make it easier for us to figure out the answers.

Besides, in my opinion, it's important to increase your exposure to IT terms and English (especially when IT isn't your major and English is not your first language). Familiarity with IT terms and English is advantageous!

5. Learn the CRISC Review Manual and the CRISC Review Questions, Answers & Explanations Manual (QAE)

Believe me that these two books published by ISACA are the sacred reference for every CRISC candidate. Take the time to read both of them, especially the QAE. Understand the explanation of the answers suggested by the book to get the logic, perspective, and wisdom that ISACA sets out. Also, make sure to study the latest version of these books. For now, the latest Review Manual is the 7th edition, and the QAE Review 6th edition.

6.  Let's practice through the mock exams

Having a mock exam is essential so that we get used to sitting and thinking without interruption and distraction for hours. Work on the questions until you score at least 80% right answers. I tried to complete each mock exam in 2 hours to exercise my quick thinking and ability to finish the exam under pressure. 

7. Mind our physical and mental state

Maintaining health and fitness for an exam is vital. Make sure you get enough sleep so that the next morning we are fit to do 150 questions in 4 hours. Also make sure we take our breakfast, arrive at the test center or proctored exam website early, and last but not least manage our emotional and mental state. Be calm. You have prepared enough and are ready to face this test. 

8. Pray

I will always repeat this in every exam tips I write because it is that salient. Pray that we will be at ease in working on those questions. Pray that the questions will favor our knowledge and preparation.

9. Miscellaneous Tips

a. First things first, read the syllabus to understand what is covered and the portion of each domain compared to the whole exam material.

b. Scheduling the exam is one of the best ways to start studying and then stick with the date. Please don't follow my experience of rescheduling it until the very last time.

c. The knowledge we gained from experience is something to be treated wisely: sometimes it helps, sometimes it doesn't. The knowledge that we have gained may not be in line with the standards/frameworks set by the ISACA, so we must identify the alignment of our knowledge with the ISACA's body of knowledge.

10.  Tips During the Exam:

a.  If you take the exam at the test center, pay attention to the temperature of the test room. If it is too cold to stay inside for 4 hours, wear a jacket. Also, sit as comfortable as possible. Four hours is not a short time, sweetie. 😊

b. Do it serenely. We have a relatively long time to do it. If we are calm, we’ll be more careful. On exams where there are many tricky questions and answers (and accuracy becomes the key), managing our tranquillity is a must.

c. Focus on the easy questions first. We can skip the difficult/long questions (don't forget to flag them). We can always come back to them later.

d. Be careful with the “almost correct” answers. In general, CRISC questions leave us with 2 alternative answers that both seem true. Hehe. Make sure you choose the right one, not one which looks like it.

e. The duration of the exam allows us to review the answers. Review the answers as if we do it again from the beginning. Don't get bored just yet even though your stamina and concentration have decreased. Use the 4 hours fully.

f. If you take the option of a proctored exam (like what I did this time), you have toilet breaks twice (10 minutes each). These breaks are also provided if you take the test in the test center. Read the exam guidance thoroughly to know the do and don’t, like we shouldn’t read the question aloud. I advise you to launch the exam 30 minutes before your exam time. That way, in case you face technical issues, you still have time to solve them.

g. Don't forget to fill out the post-test questionnaires.

Those are the tips I can share with everyone who wants to take the CRISC exam. Good luck, everyone. If you have anything to ask, feel free to reach out. It's my pleasure to help you. Cheers!

---------

Indonesian version: Pengalaman Mengikuti Ujian CRISC